Teams IT support scams deliver malware and ransomware

Cybersecurity researchers have highlighted a recurring social engineering pattern in hundreds of incidents where attackers exploit Microsoft Teams’ external chat feature to impersonate IT staff and deliver malware. Arctic Wolf Labs notes that the same throwaway tenants, IT-themed display names, remote-access tools, and payload domains appear across multiple campaigns, with a growing emphasis on convincing identities such as “IT Support (Internal)” to bypass external-user warnings.

In many cases, attackers register Teams sessions via newly created or acquired Microsoft 365 tenants and flood victims’ inboxes with newsletter or subscription confirmations beforehand, creating a false sense of urgency before a Teams message arrives.

A notable tactic involves using permanent fallback domains under the onmicrosoft[.]com space, including examples like helpdeskteam365.onmicrosoft[.]com and itendpoint365.onmicrosoft[.]com, sometimes augmented with a company name in the display name to bolster legitimacy. Arctic Wolf reports a recent shift toward paid top‑level domains (approximately half of fake identities used .top, with others using .com or other multi-level domains).

Campaigns target organisations with external access enabled and often employ vishing to coax victims into granting hands-on-keyboard access via legitimate remote tools such as Quick Assist, AnyDesk, ScreenConnect, TeamViewer, and others. The attackers then use the access to perform reconnaissance, deliver payloads such as the GoGRPC backdoor, move laterally to domain controllers, and, in some cases, deploy ransomware or exfiltrate data.

In one case, a PowerShell command downloaded an MSI from Microsoft Azure Blob Storage, executing a Python implant and transmitting AD data to an external server.